FTP Banner & Server Enumeration
This phase identifies what FTP server is running and how it is configured. The version and daemon type drive every decision that follows. Knowing the exact software lets you target relevant CVEs. Configuration details reveal whether credentials travel in cleartext or over TLS.
Grab Service Banner and System Details
| ftp-syst: | STAT: | FTP server status: | Connected to 192.0.2.13 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 1 | vsFTPd 2.0.5 - secure, fast, stable |_End of status
Reveals:
FTP daemon name
Operating system
System type and architecture
In the sample output, the server identifies as vsFTPd 2.0.5. That version is old and carries known vulnerabilities. The session shows TYPE: ASCII and control connection is plain text. Both mean credentials and data traverse the wire unencrypted. A packet capture on the same segment exposes them. The session timeout of 300 seconds is the vsFTPd default, which signals a stock, unhardened installation. Client count of 1 at session startup indicates the server was idle. Cross-reference the version string against CVE databases before moving on.
Retrieve FTP Banner Manually
Manual banner grabbing is useful when:
Nmap output is filtered or incomplete
You want raw, unprocessed responses
Testing connectivity without scripting
A successful connection returns a 220 response code followed by the banner string. The banner often includes the daemon name and version directly. Some hardened servers suppress or spoof this string with a generic message. If port 21 is filtered, nc will hang or refuse the connection. That usually means a firewall or host-based rule is blocking access. Try alternate ports like 2121 or 990 for implicit FTPS. If nc returns 421, the server is rejecting connections due to limits or IP-based restrictions.
For FTPS (Explicit TLS): Wrap the connection with OpenSSL to handle the TLS upgrade:
Then send commands manually (e.g., type QUIT to see the banner/response). Add -quiet to suppress certificate warnings during testing. The TLS certificate is worth inspecting. It may reveal the internal hostname, organization name, or certificate authority. A self-signed certificate is common on internal or poorly configured servers. If the TLS handshake fails entirely, the server may use implicit FTPS on port 990. Try connecting directly on port 990 without the -starttls flag.
Check Supported FTP Features (FEAT)
Identifies supported extensions such as:
UTF8
AUTH TLS
Passive mode behavior
Extended commands
Unexpected or outdated features may indicate weak security controls.
If AUTH TLS is absent, the server does not support TLS. Credentials sent to it travel in cleartext. That is actionable from any position where you can intercept traffic. If PASV or EPSV is missing, the server does not support passive mode. That matters when connecting from behind NAT or through a proxy. MLST or MLSD entries indicate a more modern daemon. Their presence can narrow your version search. Extended commands like SITE CHMOD or SITE EXEC are worth testing after authentication. Some daemons expose dangerous functionality through them. Version strings gathered here, combined with the banner, give you enough to search for CVEs. Check exploit-db for public proof-of-concept code targeting the specific version.
For FTPS: Use the OpenSSL-wrapped connection above, send AUTH TLS first if needed, then FEAT.
This information helps identify the exact server software and version for targeted vulnerability research in later phases.